Qatar Central Bank Cloud Computing Regulation (2024) 11.13: Conduct an initial security and risk assessment, a TVRA, continuity, financial and standards checks before implementation

What does 11.13 require?

Before implementing cloud services and undertaking the outsourcing, an entity assesses the security and risk of the service to surface weaknesses in information security, cybersecurity and other IT controls against the Sector-Specific Security Regulation; the assessment names the security threats and operational weaknesses and sets safeguards against them, considering at least the nature of the service and its underlying arrangements, the provider and service location, the criticality and confidentiality of the assets, the transition and handover process, adherence to recognised technical security standards and compliance with international and domestic standards, and may draw on existing external assurance from independent auditors. The entity also runs a threat and vulnerability risk assessment of the CSP, or an equivalent independent one, confirms the CSP holds disaster recovery and business continuity plans, reviews in detail the financial information publicly available or provided about the CSP, and assesses the arrangement's compliance with the global standards adopted under its policy and with this regulation, relying where appropriate on an independent reputable assurance report.